CVE-2016-5312: Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote authenticated users to read arbitrary…

PriorityP358medium6.5CVSS 3.0

AVNACLPRLUINSUCHINAN

EXPLOIT

EPSS

53.70%

98.9th percentile

Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the sn parameter to brightmail/servlet/com.ve.kavachart.servlet.ChartStream.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
symantec	messaging_gateway	<= 10.6.1	—

Detection & IOCsextracted from sources · hover to see the quote

url/brightmail/servlet/com.ve.kavachart.servlet.ChartStream?sn=../../WEB-INF/lib↗

path/brightmail/servlet/com.ve.kavachart.servlet.ChartStream↗

filenamekavachart-kcServlet-5.3.2.jar↗

→Monitor HTTP GET requests to the ChartStream servlet endpoint containing '..' sequences in the 'sn' query parameter, indicating directory traversal attempts. ↗
→Alert on HTTP requests to '/brightmail/servlet/com.ve.kavachart.servlet.ChartStream' where the 'sn' parameter contains path traversal strings (e.g., '../../') targeting sensitive paths such as WEB-INF. ↗

·Exploitation requires the attacker to be an authenticated (but potentially low-privileged) user of the Symantec Messaging Gateway control center; unauthenticated access alone is insufficient. ↗
·The vulnerability is present in Symantec Messaging Gateway versions before 10.6.2; version 10.6.1 was confirmed as the latest affected version at time of disclosure. ↗

CVSS provenance

nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.